This document outlines the network configurations required for FCM to function correctly within your network environment.
Configure your Network for sending messages to FCM
Before you begin, you need to make sure your system is communicating with FCM servers for sending messages and managing subscriptions.
To send FCM messages or manage subscriptions, your network will need to communicate with the following servers over https:
- fcm.googleapis.com (message sending)
- accounts.google.com (authentication for message sending)
- iid.googleapis.com (topic subscription & device group management)
This list is subject to change over time. We are unable to provide an ip based allowlist for these end points.
Configure your Network for Android devices using FCM
This section details how to configure your network to support FCM traffic for Android devices.
FCM ports and your firewall
The vast majority of networks don't limit devices from connecting to the rest of the internet. In general, this is our recommendation. However, some organizations require firewalls as part of their perimeter security plan.
Firewall options
| Option | What we do | Specific rules | Notes |
|---|---|---|---|
| None (preferred) | - | - | - |
| Port based filtering (second choice) | Limit traffic to specific ports | TCP ports to open:
|
This is the simplest rule and prevents dependence on things that are more likely to change over time. |
| Hostname based filtering | Using a special firewall configuration to allowlist certain TLS SNI entries to pass through the firewall. This may be combined with port based filtering. | Hostnames to open:
|
Not all firewall software supports this but many do. This list is pretty stable but we won’t proactively notify you if it changes. |
| IP based filtering (strongly not recommended) | Use a very large static list of ip addresses. | Allowlist all of the IP addresses listed in goog.json. This list is updated regularly and you are recommended to update your rules on a monthly basis. Problems caused by firewall IP restrictions are often intermittent and difficult to diagnose. | We change our IP address list very frequently and without warning so you will need to enter this big list and to update it frequently. Additionally, we see frequent typos when people try to enter ip allowlists in their firewall rules. We don't recommend this because invariably the information gets out of date and is not maintained. Additionally the size of the list can be unwieldy for some routers. |
Network Address Translation or Stateful Packet Inspection firewalls
If your network implements Network Address Translation (NAT) or Stateful Packet Inspection (SPI), implement a 30 minute or longer timeout for our connections over ports 5228-5230. This enables us to provide reliable connectivity while reducing the battery consumption of your users' mobile devices.
FCM and Proxies
FCM's protocol for delivering push messages to devices is not able to be proxied through network proxies. As such you will need to ensure that the FCM connection from devices on your network can connect directly with our servers.
VPN interactions and bypassability
Firebase Cloud Messaging takes various steps to ensure that the push messaging connection from the phone to the server is reliable and available as often as possible. The use of a VPN complicates this effort.
VPNs mask the underlying information that FCM needs to tune its connection to maximize reliability & battery life. In some cases VPNs actively break long lived connections resulting in a bad user experience due to missed or delayed messages or a high battery cost. When the VPN is configured to allow us to do so, we bypass the VPN using an encrypted connection (over the base network Wi-Fi or LTE) so as to ensure a reliable, battery friendly experience. FCM's usage of bypassable VPNs is specific to the FCM Push Notification channel. Other FCM traffic, such as registration traffic, uses the VPN if it is active. When the FCM connection bypasses the VPN it loses additional benefits the VPN may provide, such as IP masking.
Different VPNs will have different methods for controlling whether or not it can be bypassed. Consult the documentation for your specific VPN for instructions.
If the VPN is not configured to be bypassable then Firebase Cloud Messaging will use the VPN network in order to connect to the server. This may result in periods of time where messages are delayed and may result in more battery usage as Cloud Messaging works to maintain the connection over the VPN connection.